GIMP CVE-2026-112257

Exploitation requires the victim to open or browse (thumbnail-preview) a crafted PSD file in GIMP, and that PSD must embed a grayscale (non-RGB) JPEG thumbnail resource - the loader unconditionally performs a BGR-to-RGB channel swap with a hard-coded 3-byte stride without verifying the thumbnail is RGB, so a 1-channel grayscale thumbnail drives the out-of-bounds access. Limiting factors that reduce realistic risk: the attack is local (AV:L) with no network path, it requires user interaction (UI:R) to open or preview the file, and it depends on GIMP being the handler for the malicious PSD; it does not require any authentication or special privileges (PR:N) and works against default GIMP behavior once the file is opened.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is driven by the high triple-impact (confidentiality/integrity/availability), but the Local attack vector and Required user interaction substantially temper real-world urgency - this is not a remotely-reachable server flaw but a client-side file-parsing bug that needs a victim to open or browse a malicious file. No EPSS score, KEV listing, or POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal of active exploitation or weaponization. A notable internal conflict: the CWE is CWE-121 (stack-based buffer overflow) and the Tags include 'Stack Overflow,' yet the description explicitly describes a heap out-of-bounds read and write - the heap description and CWE-121 disagree, so the exact memory-corruption primitive should be verified with the Red Hat/GIMP advisory. Overall this is a legitimate but moderate-priority client-side vulnerability: patch in normal cycles, prioritize on multi-user or analyst workstations that routinely open untrusted image files, rather than treating it as an emergency.

An attacker crafts a malicious PSD file containing a grayscale (non-RGB) JPEG thumbnail resource and delivers it to a victim via email, download, or a shared directory. Because the AV:L/UI:R vector requires local interaction, the victim must open the file in GIMP - or merely browse a folder where GIMP generates thumbnails - at which point the fixed 3-byte BGR-to-RGB stride swap reads and writes past the heap buffer, causing a crash and potentially arbitrary code execution in the plug-in process. No public exploit code is identified in the provided data, so this is a plausible but currently theoretical attack path.